Re: Accepted fuse 2.8.4-1.1+deb6u1 (source amd64) into squeeze-lts

[Mike Gabriel <mike.gabriel@das-netzwerkteam.de>]

Hi László,

On  Fr 05 Jun 2015 21:03:03 CEST, László Böszörményi (GCS) wrote:

> Hi all,
>
> On Thu, Jun 4, 2015 at 11:18 AM, Mike Gabriel
> <mike.gabriel@das-netzwerkteam.de> wrote:
> > On  Mi 03 Jun 2015 16:12:19 CEST, Holger Levsen wrote:
> > > On Dienstag, 2. Juni 2015, Laszlo Boszormenyi wrote:
> > > > Source: fuse
> > > > Version: 2.8.4-1.1+deb6u1
> > >
> > > there was no DLA for this upload, could you please prepare one and send it
> > > to
> > > the list?! Thanks already.
>  You mean to debian-lts-announce, right?
>
> > Let me know if you need a hand with this.
>  Please review the following, I'm open for suggestions.
> -- cut --
> Subject: [DLA 238-1] fuse security update
>
> Package        : fuse
> Version        : 2.8.4-1.1+deb6u1
> CVE ID         : CVE-2015-3202
> Debian Bug     : #786439
>
> Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not
> scrub the environment before executing mount or umount with elevated
> privileges. A local user can take advantage of this flaw to overwrite
> arbitrary files and gain elevated privileges by accessing debugging
> features via the environment that would not normally be safe for
> unprivileged users.
>
> For the old-oldstable distribution (squeeze-lts), this problem has been fixed
> in version 2.8.4-1.1+deb6u1.
>
> We recommend that you upgrade your fuse packages.

The announcement is ok. But...

Please request the DLA (here DLA-238-1) via bin/genDLA and immediately  
commit the resulting change to the secure-testing SVN repo. Once the  
DLA has been securely requested and has been documented in SVN, you  
can take your time with writing the announcement mail.

Santiago and I recently had the issue that we sent out mails for the  
same DLA and both committed the change to secure-testing SVN _after_  
sending. Which caused some confusion.

At the moment DLA 238-1 is still available in secure-testing SVN, so  
please commit the change to secure-testing SVN asap and only then go  
ahead with sending your announcement mail.

Greets,
Mike
--

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

Attachment: pgpVsZor6jegy.pgp
Description: Digitale PGP-Signatur